Cookie Policy

Effective Date: 12 June 2026

Overview

Tanqory uses cookies and similar tracking technologies across its platforms to enhance user experience and collect data for various purposes. This Cookie Policy outlines where and how Tanqory uses cookies, the types of cookies in operation, how user consent is managed, and how Tanqory will comply with different regional regulations. It also details cookie retention practices, the disclosure of third-party cookies/SDKs, and how this Cookie Policy will be presented (separately from the Privacy Policy) along with a detailed cookie list for transparency.

Platforms Using Cookies and Tracking Technologies

Tanqory utilizes cookies on its web platforms (e.g. tanqory.com, mytanqory.com) and mobile website. These cookies are small text files stored in the user’s browser to remember information and preferences. In Tanqory’s native iOS/Android mobile apps, traditional browser cookies are not used; however, the apps employ software development kits (SDKs) and similar technologies that function like cookies to collect user behavior and device data (for analytics, personalization, etc.). Notably, the same privacy rules that apply to website cookies also apply to mobile app trackers – organizations must handle mobile SDK data under the same consent and privacy requirements as browser cookies. In practice, this means Tanqory’s Cookie Policy covers both web cookies and in-app tracking SDKs, ensuring that user consent and data protection measures encompass all platforms.

Types of Cookies We Use

Tanqory categorizes its cookies based on their purpose and functionality, in line with standard practices:

• Strictly Necessary Cookies: These cookies are essential for the website to function properly and enable core features (e.g. keeping items in a shopping cart or logging in to secure areas). Such cookies are usually first-party and session-based. They do not require user consent under most laws, but we still inform users about their use and why they are necessary. Without these, services requested by the user (like navigating pages or using basic site features) cannot be provided.

• Functional (Preference) Cookies: These cookies remember user choices and preferences to provide a more personalized experience. For example, a functional cookie may save your preferred language or region so that on future visits the site appears in your chosen language. While not strictly essential, these improve convenience – for instance, auto-filling your username or remembering interface customizations. These cookies may be first-party or third-party, and typically we will seek at least implied consent for their use where required.

• Analytics/Performance Cookies: These cookies (also known as statistics cookies) collect information about how users interact with our site, such as which pages are visited, how long users stay, and any errors encountered. This data helps Tanqory measure performance and improve the website’s design and content. Importantly, the information is intended to be aggregated and anonymized – we do not use analytics cookies to identify individual users. For example, we use cookies from Google Analytics (a third-party service) to understand website traffic and usage patterns. In some cases, if analytics cookies are configured to collect personal data or to share data with third parties, they may require user consent (or offering an opt-out) under applicable laws.

• Marketing/Advertising Cookies: These cookies track users’ online activity to help Tanqory and our advertising partners deliver more relevant ads, or to limit how many times you see the same ad. Marketing cookies often profile users’ browsing habits and share data with third parties (e.g. an advertising network). They are usually persistent and commonly set by third parties (such as Facebook/Meta Pixel or TikTok Pixel on our site for advertising analytics). Because they can involve extensive data tracking and sharing, these cookies require explicit user consent in jurisdictions like the EU and an opportunity to opt out in jurisdictions like California. If users do not consent to marketing cookies, Tanqory will not set them or will disable them, ensuring no targeted ads or tracking occurs.

In addition to purpose-based categories, cookies can also be described by their source and lifespan:

• First-Party vs Third-Party Cookies: First-party cookies are those set by Tanqory’s own domain (the website you are visiting), typically used for core functionality and remembered preferences. Third-party cookies are set by external providers integrated into our site – for example, cookies from YouTube when we embed a video, or from advertising and analytics partners. These third-party cookies allow those providers (advertisers, analytics firms, social media platforms, etc.) to recognize your browser and collect information across different websites. In Tanqory's context, any cookies set by Cloudflare (CDN/security/Turnstile), Stripe (checkout), Sentry (error tracking), or the third-party platforms enumerated in the cookie table below would be considered third-party cookies. We will clearly disclose all such third-party cookies in our policy (see Third-Party Cookies section below) and, where required, obtain your consent before loading them.

• Session vs Persistent Cookies: Session cookies are temporary cookies that last only for the duration of your browsing session on our site; they are deleted once you close your browser. These are often used for necessary functions like keeping you logged in as you navigate between pages. Persistent cookies, on the other hand, remain on your device for a set period even after you close the browser. They have an expiration date coded into them and are used to remember your preferences or login info for future visits, or for long-term analytics and advertising tracking. For instance, if you select “Remember me” at login, a persistent cookie will save your credentials so you don’t have to sign in again next time. Tanqory sets persistent cookies only for the durations necessary and as outlined in our cookie table. We also respect legal requirements on cookie lifespan (explained in the Retention section below), deleting or anonymizing persistent cookie data after a maximum period to protect user privacy.

Cookie Consent Management

Current state: At present, Tanqory does not yet use a dedicated Consent Management Platform (CMP) or similar automated tool to manage cookie consent. This means that historically some non-essential cookies may have been set by default. However, regulatory compliance (and user trust) demands that we obtain user consent for cookies that are not strictly necessary, especially in jurisdictions with strict privacy laws. No cookies beyond the “necessary” category will be set unless and until appropriate consent is obtained from the user in those regions. Tanqory is in the process of implementing a robust consent management solution to align with these requirements.

Future improvements: We plan to deploy a cookie consent banner and preference center that will allow users to opt in to optional cookies (or opt out, depending on region – see next section) before those cookies are activated. This system will likely involve a CMP that can automatically block non-essential cookies until consent is given and keep a record of users’ consent choices. For example, users landing on our site from the EU will first see a cookie consent banner requesting permission for categories like analytics and marketing cookies (with options to Accept, Reject, or customize settings), ensuring prior explicit consent is collected. Users from regions that follow an opt-out model will still be presented with clear information and a way to disable cookies if they choose. Currently, without a CMP, Tanqory acknowledges that implied consent (e.g. “by continuing to use this site, you accept cookies”) is not sufficient in many cases – for instance, EU GDPR does not recognize implied consent for cookies. Therefore, implementing an active consent mechanism is a top priority.

Example of a cookie consent banner with granular controls. This banner illustrates how Tanqory’s implementation will work: it clearly informs the user about cookie usage and provides explicit choices – such as accepting all cookies, rejecting non-essential cookies, or allowing only certain categories. Important cookie categories (Necessary, Preferences, Analytics, Marketing) are typically listed with toggles, and no non-essential cookies are set until the user makes a choice. This approach ensures compliance with laws that require opt-in consent (e.g. GDPR, PDPA) by recording a user’s affirmative decision before dropping any optional cookies. It also gives users an easy way to refuse cookies (e.g. a “Deny” or “Reject All” button), fulfilling the requirement that refusing cookies should be as simple as accepting them. Tanqory’s forthcoming consent tool will also allow users to later change or withdraw their consent just as easily, via a preferences interface (for example, an on-page “Cookie Settings” link where they can adjust their selections).

In summary, although Tanqory does not have a consent manager in place yet, we are actively working to implement one. This will ensure that no non-essential cookies are deployed without user consent where required, and that users everywhere have control over what data is collected about them. We recognize that this is not only a legal obligation in many regions but also a best practice for transparency and user trust.

Regional Cookie Consent Requirements

Different jurisdictions have varying laws and expectations regarding cookie consent. Tanqory intends to tailor its cookie consent approach by region to comply with each applicable law’s requirements (while maintaining a high standard of privacy protection globally). Below is an overview of how we will manage consent in key regions:

• European Union & United Kingdom: Tanqory will follow a strict opt-in consent model in the EU and UK. Under the EU’s ePrivacy Directive and General Data Protection Regulation (GDPR), we cannot set any cookies except strictly necessary ones unless the user has given prior consent after clear disclosure. This means EU/UK visitors will see a cookie banner requesting consent for any analytics, functional, or advertising cookies. We will provide detailed information about each cookie’s purpose and will not pre-check any opt-in boxes. Users must actively click “Accept” for categories of cookies (or individually) before those cookies are enabled. Equally important, users who choose not to accept cookies (or ignore the banner) will still be able to access our site – we will not use any “cookie wall” that blocks usage for those who decline cookies. We will also make rejecting cookies just as straightforward as accepting them (for example, offering a prominent “Reject All” button alongside “Accept All”). Furthermore, once given, consent can be withdrawn at any time, and we will honor such choices promptly. In practical terms, Tanqory’s compliance in Europe/UK means no non-essential cookie (e.g. Google Analytics, Meta Pixel) will load until the user consents, and our banner will align with GDPR’s standards for informed, unambiguous consent.

• United States & Canada: In the United States, there is no federal law mandating cookie consent banners, but privacy laws at the state level (especially California’s CCPA/CPRA) grant users rights regarding data collected by cookies. Tanqory will operate under an opt-out model in the US and Canada, which generally means we can set cookies by default after providing notice, but we must allow users to object/opt-out of certain data uses. For US visitors, our website will include a clear “Do Not Sell or Share My Personal Information” link (as required by CCPA/CPRA) if our cookies involve selling or sharing personal data with third parties. This mechanism lets users opt out of the “sale” of data collected via cookies, such as information used for targeted advertising. Our cookie banner or notice for U.S. users will likely be simpler (e.g. “We use cookies for analytics and ads. By using this site, you agree to our Cookie Policy. [Learn more] [Opt out]”). We will still inform users at or before the point of data collection about what categories of data our cookies collect and their purposes, per CCPA requirements. For Canadian users, we comply with Canada’s PIPEDA which requires obtaining valid consent for collection of personal data – in online practice this often means providing notice of cookie use and relying on implied consent if the user continues to use the site, so long as the user has the ability to opt out. Thus, Canadian visitors will see a cookie notice and have access to our cookie settings to disable non-essential cookies if they wish. In both US and Canada, we do not require an explicit opt-in before setting cookies, but we honor any “Do Not Sell” signals or opt-out preferences. For instance, if a California user clicks our “Do Not Sell” link or uses a browser-level global privacy control, we will disable any third-party trackers that would share data (and refrain from setting them on future pages). In summary, notice-and-opt-out is the approach: we will be transparent about cookies and provide easy opt-out, but we won’t necessarily block cookies upfront as we do in the EU.

• Brazil: Brazil’s Lei Geral de Proteção de Dados (LGPD) is a comprehensive data protection law similar to the GDPR. Recent guidance from Brazil’s data protection authority (ANPD) indicates that affirmative opt-in consent is required for non-essential cookies, and organizations should offer users the ability to reject cookies and later withdraw consent. This means, strictly speaking, Brazil is moving toward an EU-style model for cookies. Tanqory’s intent is to comply with LGPD fully. Users in Brazil will therefore likely be presented with a cookie banner that requires opt-in for analytics and advertising cookies just as an EU user would. (We note that Tanqory’s initial plan grouped Brazil with opt-out regions, but given ANPD’s 2022 cookie guidelines, we will adapt to ensure compliance.) We will inform Brazilian users of all cookie categories and not set non-necessary cookies unless consent is obtained. Additionally, per ANPD recommendations, our Cookie Policy will disclose the categories of cookies in use, their purposes, retention periods, and whether cookie data is shared with third parties (see the Cookie Disclosure section). Users will have the opportunity to reject cookies from the start and to revoke consent easily later. In essence, Tanqory will treat Brazil in line with GDPR requirements for cookies to err on the side of privacy protection – obtaining clear consent first, in spite of any earlier opt-out plans.

• Asia (e.g. Singapore, South Korea, etc.): Tanqory will adhere to the cookie and privacy laws of each Asia-Pacific country where we operate or have users. Many APAC jurisdictions are strengthening consent requirements for cookies and trackers:

  • Singapore: Singapore’s PDPA does not have a specific cookie law, but it requires organizations to obtain consent before collecting, using, or disclosing personal data, which includes data collected via cookies (Singapore authorities consider identifiers like cookie IDs and IP addresses as personal data). Singapore allows for “deemed consent” in some cases – meaning if a user is notified of the purposes and given a chance to opt out, their continued use of the site can be taken as consent. In practice, Tanqory will likely show Singapore users a cookie notice banner that informs them of our cookie use and provides a “manage cookies”/opt-out option. If the user continues without opting out, we will treat it as consent (as permitted under PDPA’s deemed consent by notification framework). However, we aim to be transparent and user-friendly, so we may still offer an “Accept” button for clarity and a link to a preferences center to opt out of certain cookies. We will also ensure that, per PDPA, consent is not a condition of service – users who opt out of cookies will still be able to access our site (perhaps with slightly reduced personalization).

  • South Korea: South Korea’s privacy law (PIPA) is one of the strictest in Asia and generally requires opt-in consent for using cookies or similar tracking that collect personal information. Tanqory will treat Korean users similarly to EU users – presenting a consent banner and obtaining explicit consent for any cookies beyond the necessary ones. We note that PIPA doesn’t demand consent as explicitly as GDPR in some cases, but recent enforcement trends in Korea favor a clear consent approach, so we will err on the side of explicit consent for cookies to ensure compliance.

  • Other Regions: For other Asian countries such as Japan and India, cookie requirements are still evolving. Japan’s APPI treats certain online identifiers as personal data in specific contexts, and while explicit cookie consent banners are not yet ubiquitous in Japan, Tanqory will follow the spirit of transparency and obtain consent where personal data is involved. India’s new data protection law (if applicable) and other countries’ laws will be monitored. In many Asia-Pacific countries, a notification with an opt-out option may suffice when cookies are not used to profile individuals, but Tanqory will always provide an easy way for users to decline cookies if they choose. In summary, for Asia, Tanqory’s default will be to respect local laws – implementing explicit consent banners in countries that mandate it, and at minimum showing a clear cookie notice (with an opt-out mechanism) in others. We prefer a conservative approach: even where implied consent might be technically acceptable (as in Singapore), we strive to give users a straightforward ability to choose their cookie settings.

By tailoring our cookie consent approach in this manner, Tanqory ensures compliance with regional regulations such as GDPR/UK ePrivacy, CCPA/CPRA, LGPD, PDPA, PIPA, etc., while providing all users with transparency and control over their data.

Cookie Retention and Expiry Policy

Tanqory has established policies for how long cookies remain active on a user’s device, in order to minimize privacy risks and comply with regulations. In general, session cookies (as noted earlier) expire immediately when you end your session (log out or close the browser). Persistent cookies will be configured with a fixed expiration date, and we aim to limit their duration according to the strictest applicable law:

• 13-Month Maximum Lifespan: Tanqory will not keep any non-essential cookie active for longer than 13 months from when it’s set (and in many cases far shorter). This is based on guidelines from certain regulators – for example, France’s CNIL (Commission Nationale de l’Informatique et des Libertés) requires that analytics cookies have a lifespan no greater than 13 months. We have adopted 13 months as a general upper limit to align with such best practices. In effect, this means if you consent to analytics or advertising cookies, those cookies will automatically expire (stop functioning) after 13 months unless you re-consent. This periodic expiration ensures that a user’s consent is refreshed at least annually, as recommended by EU authorities.

• Regular Deletion and Refresh of Consent: In jurisdictions where the law is less specific about cookie duration, Tanqory still commits to not retaining cookie data indefinitely. We will periodically purge or anonymize data obtained from cookies. For example, analytics data associated with identifiers will be deleted or anonymized on a rolling basis after 25 months (this aligns with CNIL’s recommendation that data collected via cookies not be kept longer than 25 months). Moreover, we will ask users to reconfirm their cookie consent periodically (e.g. once a year) to ensure ongoing compliance with consent requirements, especially in the EU.

• Policy Updates: If Tanqory adds new cookies or changes the purpose of existing cookies, we will update this Cookie Policy and, if required, prompt users for consent again. We recognize that maintaining an up-to-date cookie policy is a continuous process, since cookies and trackers can change over time. Our website will be scanned regularly for any new or changed cookies, and the policy (and consent banner) will be adjusted accordingly. Users will always be informed of significant changes to our cookie usage. We will indicate the last update date of this policy at the top, and if the changes are material (for instance, introducing a new category of cookie or a new third-party provider), we may proactively notify users (via a banner or email) in addition to updating the text.

In summary, Tanqory’s approach is to minimize cookie retention periods and to regularly cleanse cookie data. By limiting cookies to 13 months (or less) and renewing consent on at least an annual basis where required, we comply with strict regulations (like French law) and uphold good data hygiene. Users can also clear cookies from their own browsers at any time, and our site will respect that by not re-setting cookies unless you consent again. Any preferences you have (including a record of your consent or opt-out choices) may themselves be stored in a special cookie (commonly called a “consent cookie”). That consent cookie, as per industry practice, will also be designed to expire after a set time (no longer than the above limits) so that we periodically reconfirm your choices.

Third-Party Cookies and SDKs on Tanqory’s Platform

Tanqory integrates a number of third-party services into our websites and apps to achieve functionalities like analytics, advertising, customer support, and social media content. These services often set their own cookies or use related tracking technologies. We believe in full transparency about all such third-party trackers. In this Cookie Policy (and the accompanying cookie table), we disclose the identity of each third-party cookie/SDK used, its purpose, and other key details.

Examples of third-party cookies/SDKs used on Tanqory include:

• Cloudflare: for CDN, security, bot management, and the Turnstile anti-bot challenge service (may set cookies like __cf_bm to distinguish humans from bots).

• Sentry: for error tracking and diagnostics with minimized/pseudonymized data.

• Stripe: for secure payment processing (may set payment session cookies during checkout).

• Liveblocks: for real-time collaboration features in the merchant admin (may use WebSocket identifiers; not a browser cookie but functions similarly).

• PostHog: for product analytics (measuring feature usage and funnels). PostHog may set analytics cookies / local-storage identifiers; these are non-essential and are loaded only after consent in opt-in regions.

• Customer.io (Peaberry Software, Inc.): for marketing communications orchestration (lifecycle marketing email, marketing SMS, marketing push, and in-product marketing messages). The Customer.io in-product messaging surface used on legal.tanqory.com and other Tanqory web properties may set cookies, local-storage identifiers, and device fingerprints to deliver and attribute marketing messages. Customer.io is classified as a Marketing/Advertising category tracker; it is non-essential and is loaded only after consent for the marketing category is granted via the consent banner or preference center. For EU/EEA/UK visitors, the EU region of Customer.io (Frankfurt) is used and no Customer.io cookies are set prior to consent. The Customer.io processing of personal data — including data categories, transfer mechanism, region routing, and the executed DPA — is disclosed in the Subprocessor List and is the marketing-route provider identified in the Marketing Communications Compliance Policy §8.2. Transactional and service-operational communications (account, billing, MFA, security, dunning) do not use Customer.io and do not set Customer.io cookies.

• Mobile App SDKs: in our mobile apps, we include SDKs that function similarly to cookies. These include: the Sentry SDK for in-app telemetry; the Firebase Cloud Messaging / APNs SDKs for push notification delivery; Google Analytics for Firebase for app usage analytics; and Google Ads on-device conversion measurement for advertising attribution. The advertising-conversion SDK relies on the device advertising identifier (IDFA on iOS, AAID on Android) and, on iOS, is used only after you grant permission through Apple's App Tracking Transparency prompt. These SDKs may store identifiers on the device; analytics and advertising SDKs are non-essential and are subject to consent where required. See the Mobile App Privacy Disclosures for full details.

All third-party cookies and SDKs on our platform are evaluated for privacy impact. We will provide a list of third-party trackers in the cookie table, including the provider name, what the cookie/SDK is called, its purpose (e.g. "Analytics – measures site usage" or "Strictly necessary – anti-bot challenge"), and its duration/expiration. This level of detail is recommended by many data protection authorities to ensure users are fully informed.

Importantly, Tanqory does not share personal data with third parties beyond what is described in this policy. When third-party cookies collect data via our site, those third parties may be considered separate data controllers of that information (for example, Google may use data from its analytics cookies for its own purposes in accordance with Google’s privacy policy). We advise users to review the privacy policies of these third-party providers (we will provide references or links where possible in our Cookie Policy or Privacy Policy). However, by obtaining consent for third-party cookies, Tanqory ensures that no such third-party data collection happens without your permission in jurisdictions that require consent. If you opt out of marketing cookies, for instance, the Facebook and TikTok pixels will not load, meaning no data is sent to those companies. If you opt out of analytics, Google Analytics will be disabled on our site for your browser.

In jurisdictions that follow an opt-out model, we will still honor any user preferences – if you use our cookie settings to turn off certain categories, we will disable those third-party integrations for you. Additionally, we support the Global Privacy Control (GPC) and “Do Not Track” signals for California residents: if detected, we will treat it as an opt-out of sale/sharing and deactivate third-party advertising cookies automatically.

Tanqory is committed to keeping the third-party cookie/SDK list up-to-date. Whenever we add a new third-party tool to our platform that may set cookies or collect user data, we will update our Cookie Policy and cookie list accordingly (and obtain consent if required). Conversely, if we remove a service, we will delete its cookies and remove it from the policy. Our goal is that users can check our Cookie Policy’s table at any time to see exactly which third parties might be gathering data on our site or app, and why.

Server-Side Conversion Sharing (Advertising)

Some advertising platforms let us report an event directly from Tanqory's servers instead of from your browser. Tanqory has built this connection for Meta, Google Ads, LinkedIn, TikTok and OpenAI (ChatGPT Ads), and has prepared, but not completed, a connection for X. We use it only to measure whether our own advertising leads to sign-ups and purchases.

This section describes what the connection is built to send. It is not a statement that any platform is receiving data today. Sending is controlled by a company-level switch, and we will update this policy and the Subprocessor List before we turn any platform on.

Which events. A sign-up form or lead form is submitted; an account is created or its email is verified; a first store is created; checkout starts; a first payment, a new subscription, a renewal or a plan change happens; a one-time purchase (such as AI credits, an add-on or a domain) is made; or a free trial starts or converts to a paid plan. Not every platform receives every event.

What can be shared. For each event: the event name, the time, and a unique event ID used to avoid counting the same event twice.

• A one-way encrypted (SHA-256 "hashed") version of your email address. Depending on the platform, also hashed versions of your first name, last name, country and a Tanqory account identifier.
• An advertising click or browser identifier, if you arrived from an ad and we captured it: the Meta click and browser identifiers, the Google click identifier (gclid), the TikTok click identifier and cookie value, the LinkedIn first-party ads identifier, or the OpenAI click identifier (oppref).
• For purchases, the amount and currency. For a new subscription, we may send a predicted lifetime value based on your subscription price instead of the first payment.
• For sign-up and lead forms, the page address (Meta) and, where known, how the lead came to us and a company-size band.

OpenAI (ChatGPT Ads). For OpenAI, the server-side connection sends the event name, time and ID, a hashed version of your email address and of a Tanqory account identifier, the OpenAI click identifier if you arrived from a ChatGPT ad, the page address for web events, the amount and currency for purchases, and the plan identifier for trials and subscriptions. It does not send your name, phone number or country. OpenAI also offers a browser measurement pixel that can set two cookies (__oppref and __obref). This pixel can offer to automatically match visitor information from the page (including, if enabled, unhashed location details); we will not enable that setting, and will update this policy if that changes. Tanqory has prepared that pixel but it is switched off; if we turn it on, it will load only after you accept marketing cookies and never after a Global Privacy Control or Do Not Track signal.

What is never shared. Your phone number, and your email address in unhashed form.

When it can happen. Only if you have given advertising consent (both "ad user data" and "ad personalization"), for example through our cookie banner. If we have no consent record for you, nothing is sent. Nothing is sent after we receive a Global Privacy Control or Do Not Track signal from your browser, or after you use "Do Not Sell or Share My Personal Information", because those choices record your advertising consent as withdrawn. Nothing is sent for an account that has been erased. For residents of US states with privacy laws, we ask Meta and TikTok to apply their "limited data use" settings.

Your choices. You can change or withdraw advertising consent at any time in Cookie Settings. The companies that receive these events are listed, with the data each receives, in our Subprocessor List. Each platform acts as an independent controller of the data it receives; see its own privacy policy.

Country-Specific Cookie Policy Versions (Planned)

In the future, Tanqory may maintain separate versions of the Cookie Policy tailored to specific regions or countries. The core principles will remain the same across all versions (transparency, user choice, data protection), but certain legal disclosures or options might be customized. The regions for which we anticipate separate policies or sections include:

• European Union (and EEA) / United Kingdom: A version compliant with GDPR and the ePrivacy Directive/UK PECR, emphasizing opt-in consent, the legal basis for processing (consent), and referencing EU-specific user rights. This EU/UK policy might include details on data transfers (if any cookie data is sent outside EU), and link to mechanisms like the IAB Europe Transparency & Consent Framework if we participate in it. It will also incorporate multi-language support as needed for EU countries.

• California (and possibly other U.S. states): A version addressing CCPA/CPRA requirements. This California-focused Cookie Policy or section would explain the categories of personal information collected via cookies, disclose the “sale” or “sharing” of data (if applicable), and inform users of their right to opt out of sale/share via the “Do Not Sell or Share” link. It may also cover other state laws (like Virginia CDPA, etc.) in a combined “US Privacy” version if appropriate, noting the largely opt-out nature of U.S. state laws. We will clarify that acceptance of cookies is voluntary and that opting out will not be discriminated against (rights to non-retaliation under CPRA).

• Singapore: A version to comply with Singapore’s PDPA, which might allow implied consent but requires clear notification and an easy opt-out. The Singaporean Cookie Policy would stress what constitutes consent under PDPA and how users can withdraw consent. It will also reference the broad definition of personal data (including cookie IDs) under PDPA.

• Brazil: A version aligned with LGPD, likely mirroring much of the EU version (opt-in consent), but in Portuguese and addressing Brazilian legal terminology. Brazil’s ANPD guidelines on cookies (published October 2022) will be reflected, meaning the policy will explicitly inform users of cookie purposes, retention periods, and data sharing, in Portuguese for accessibility. It will also outline how users can exercise LGPD rights (e.g. contacting us to revoke consent or request information).

• South Korea, Japan, India, etc.: We may develop specific Cookie Policy sections or addendums for other countries. South Korea’s could be in Korean and reference PIPA’s requirements. Japan’s might clarify how we treat cookie data under the APPI (e.g. as “pseudonymous data” in some cases). India’s (once its law is in effect) might outline consent requirements or deemed consent principles under the upcoming law. If feasible, we will maintain a single global Cookie Policy with region-specific sections for each of these, or separate downloadable PDFs/pages for each jurisdiction’s compliance statement.

The reason for these separate versions is to ensure absolute compliance and clarity for users in those regions. While a single global policy can cover a lot, having localized versions allows us to speak directly to the user in their context (and language) and include any legally required clauses (for example, specific wording mandated by law). It also helps us address differences: for instance, a European policy will talk about legal bases and the right to lodge a complaint with a DPA, whereas a U.S. policy will talk about the right to opt-out of sale and a “Shine the Light” contact address, etc. By geotargeting or linking the appropriate policy to users based on their region, Tanqory can provide the most relevant information. (Our Consent Management Platform will assist in this geolocation-based presentation – e.g., showing EU users the EU banner and linking to the EU Cookie Policy, and showing U.S. users the U.S. notice and policy .)

Rest assured, if separate versions are used, all will be accessible from our main website (for transparency, anyone can read any version), and key elements like our cookie list will be consistent, differing only where laws require different disclosures or approaches.

Cookie Policy Format and Transparency Measures

Standalone Cookie Policy Document: Tanqory will maintain this Cookie Policy as a separate document from our Privacy Policy, rather than merging the two. This decision is deliberate and follows common best practice. Cookies involve technical details and consent mechanisms that warrant a dedicated explanation, helping users find all cookie-related information in one place without confusion with broader privacy issues. Our Privacy Policy will contain general information about how we process personal data, but the Cookie Policy (this document) will specifically focus on cookies/trackers. We will ensure the Cookie Policy is easily accessible – for example, via a direct link labeled “Cookie Policy” in the footer of our website, alongside the Privacy Policy link. On our cookie consent banner, we will also include a link like “Learn more” or “Cookie Policy” that brings users here for full details. Notably, because this Cookie Policy is separate, we will include references back to the main Privacy Policy where appropriate (for instance, to read about how to contact us or to read more about how we handle personal data beyond cookies). Keeping the Cookie Policy separate allows us to update cookie-specific information more frequently without altering the Privacy Policy, and it aligns with regulatory guidance that obtaining consent for cookies should not be bundled with other terms. In summary, the separation underscores our commitment to clarity: users won’t have to wade through unrelated privacy information to find out about our cookies – it’s all in this stand-alone policy.

Detailed Cookie List (“Cookie Table”): To provide complete transparency, Tanqory includes a cookie table in this Cookie Policy enumerating each cookie and similar tracker in use. The table will likely be presented in a structured format (possibly HTML table or a list) that covers for each cookie/SDK: Name of the cookie, Provider (who sets it), Purpose (what it does/why we use it), and Expiration (how long it lasts on your device). We may also indicate the Type/Category (e.g. Necessary, Analytics, etc.) for clarity. Providing this granular list is considered a best practice and is recommended (or required) under several privacy laws – for instance, Brazil’s guidelines explicitly suggest informing users of each cookie’s category, purpose, and retention period. An example entry in our cookie table might be:

This is an illustrative snippet – the actual table will contain all cookies and may group them by category for readability. We will also list in-app SDKs similarly, though they are not “cookies” per se; for example, we might include a row for “Firebase Analytics (Google) – collects app usage data, device identifiers; persistent until app uninstall or data cleared”. Each entry’s “Provider” will clarify if it’s first-party (Tanqory) or the name of a third party. The “Purpose” descriptions will be written in plain language so any user can understand what the cookie does (no overly technical jargon). The “Duration” will state the lifespan or say “Session” if applicable, or “Persistent (Expires after 6 months)” etc..

By providing this level of detail in a tabular format, Tanqory ensures users can clearly see which cookies are at work and make informed decisions. For instance, if a user is particularly concerned about advertising, they can identify the marketing cookies from the table and choose to disable those. The cookie table will be kept up-to-date (as mentioned, whenever we add or remove cookies, we’ll update the table). This fulfills legal transparency obligations and builds trust – there are no hidden cookies; everything is openly listed.

Finally, at the bottom of the cookie table, we will provide instructions or links on how users can manage cookies. This includes how to change settings through our consent tool (for example, “You can change your cookie preferences at any time by clicking Cookie Settings on our site.”) and also how to disable cookies via browser settings if they prefer that method. We will also mention that users can use browser-level controls or third-party opt-out tools (like WebChoices for ad cookies) if relevant.

Current Cookie/SDK List (illustrative and kept up to date)

We maintain a live table at https://legal.tanqory.com/cookies. Below is a representative snapshot (the live page prevails):

(The live cookie page may include additional entries or updated durations/categories as we add/remove tools.)

Consent Management, Controls, and Regional Notices

• Consent Management Platform (CMP): As described in the “Cookie Consent Management” section above, Tanqory does not yet operate a dedicated CMP. Non-essential cookies/SDKs (analytics/marketing) are not set in opt-in regions (e.g., EU/EEA, UK) until consent is obtained. Once the CMP is deployed, non-essential cookies will load only after consent via a banner/preferences center with a “Cookie Settings” entry point for revisiting choices; consent events will be logged for audit, and withdrawals will be honored immediately (except for strictly necessary cookies).
• Global Privacy Control (GPC): In regions where required, we honor GPC signals by defaulting to opt-out/blocked state for non-essential/marketing trackers unless you override with explicit consent.
• Browser/App Controls: You can block/delete cookies in your browser or clear app data; some core features may not function without strictly necessary cookies.
• Ad/Analytics Partners: We will list partners (e.g., Google Analytics/Ads, Meta, etc.) in the cookie/SDK table and link to their opt-outs where available. We minimize direct identifiers (use hashed IDs where applicable).
• Cross-Border Transfers: Cookie/SDK data may be processed in countries like the U.S.; we apply SCCs/UK IDTA/Addendum and supplementary measures (encryption, minimization, access controls) to safeguard transfers. If we later certify under an approved framework (e.g., EU-U.S. DPF), we will publish the certification status.
• Retention: Each cookie/SDK entry will state its lifespan (e.g., session, 90 days, 13 months). Consent records/logs are kept only as long as needed for compliance and then deleted.
• CCPA/CPRA Notices: We do not sell personal data. If we ever “share” for cross-context ads, we will provide a clear “Do Not Sell/Share My Personal Information” link and honor opt-outs (including GPC). Notice at Collection and sensitive personal information use limits are addressed via our legal/help center pages.
• Children: Services are not directed to children below the applicable age (e.g., under 13 under COPPA). If we learn of collection without parental consent, we will delete promptly.

Updates and change log

• Material changes (e.g., new cookie categories/partners or CMP behavior) will be posted at https://legal.tanqory.com with the effective date/version and, where appropriate, announced via banner/email or dashboard notice before taking effect. Non-essential cookies remain blocked until consent in opt-in regions even after an update.
• Version history:
  • 2.7 (25 September 2026): Added OpenAI (ChatGPT Ads) to the server-side conversion sharing section (fields, consent conditions) and noted the prepared, switched-off OpenAI browser pixel and its two cookies. The section states what is built and does not state that OpenAI is receiving data.
  • 2.6 (25 September 2026): Added a section on server-side conversion sharing with advertising platforms (Meta, Google Ads, LinkedIn, TikTok; X prepared but not connected): the events, the data fields, the advertising-consent and Do-Not-Sell/GPC conditions, and what is never sent. The section states what the connection is built to do and does not state that any platform is receiving data.
  • 2.4 (26 June 2026): Added the first-party functional cookie tanqory_pending_prompt. It is set on .tanqory.com only when a visitor submits a prompt in a "describe/build your store" input on a Tanqory marketing site. It briefly carries the submitted text (and the selected model and locale) to the sign-up / AI store-builder flow (admin.tanqory.com/chat) so that flow can pre-fill the request; it is cleared once consumed, and the builder ignores any payload older than 10 minutes. It is not used for tracking, analytics, or advertising. The same payload is also passed via the destination URL (?p=) as a fallback. [FOUNDER TO CONFIRM: consent treatment — the cookie is created only on the user's affirmative submit and is classified Functional; confirm whether any opt-in region requires it to be gated behind the consent banner rather than relying on the submit action.]
  • 2.3 (12 June 2026): Disclosed Customer.io (Peaberry Software, Inc.) as a Marketing/Advertising-category third-party tracker for marketing communications orchestration (lifecycle marketing email, marketing SMS, marketing push, and in-product marketing messages on Tanqory web properties including legal.tanqory.com). Non-essential and loaded only after consent for the marketing category; EU/EEA/UK visitors processed in the Customer.io EU region (Frankfurt). Corresponds to Subprocessor List v3.2 and Marketing Communications Compliance Policy v1.1.
  • 2.2 (28 May 2026): Added PostHog (product analytics) and mobile SDK trackers (Google Analytics for Firebase; Google Ads on-device conversion measurement using IDFA/AAID subject to App Tracking Transparency); cross-referenced the Mobile App Privacy Disclosures.
  • 2.1 (28 May 2026): Reconciled the third-party cookie/SDK list with the verified subprocessor registry (apps/legal/_compliance/sources-of-truth/01-subprocessors.yaml); removed Datadog RUM, Zendesk, and Intercom references (not engaged subprocessors); added Cloudflare Turnstile.
  • 2.0 (5 Dec 2025): Updated cookie/SDK list and clarified cross-border wording and CMP status.